The coreutils Rust rewrite story is pretty funny.

[petersommerlad@mastodon.social]

using std::cout concurrently does not cause data races (no UB). If youvwant to get output readably together use std::osyncstream wrapper around the global object or any other shared ostream object.

[puppygirlhornypost2@transfem.social]

@Seirdy@pleroma.envs.net @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space one of the things you notice when you're using MacOS, FreeBSD etc... they parse arguments differently. They don't rely on getopt_long (GNU's getopt shit) and so you end up with situations like

rm -rf ./shitass -v

not running because -v is an unknown file, and it expects the arguments before.

[puppygirlhornypost2@transfem.social]

@lcamtuf@infosec.exchange @Seirdy@pleroma.envs.net @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space like it's really kinda fascinating in a way, but also immensely frustrating if you were used to "gnuisms".

[tobinbaker@discuss.systems]

@lcamtuf the only dumb thing I can see is that Canonical decided to switch before a comprehensive external audit had been performed.

[k4t3@comp.lain.la]

@lcamtuf fearless concurrency

[ireneista@adhd.irenes.space]

@jay @r webkitgtk is a browser engine that runs inside gtk

[puppygirlhornypost2@transfem.social]

@ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place I thought it was entirely independent from gnu coreutils.

[seirdy@pleroma.envs.net]

@puppygirlhornypost2@transfem.social @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space ShellCheck my beloved

[doomed_daniel@mastodon.gamedev.place]

@Seirdy @ireneista @lcamtuf @puppygirlhornypost2

but things like PCRE2 are probably not that critical here, at least if there is some PCRE2-compatible regex implementation for rust that can be used there.

At least looking at that posts about the CVEs, the critical knowledge is what system calls to use in what order with what arguments to avoid race conditions when creating files and such (and setting their permissions)

[puppygirlhornypost2@transfem.social]

@lcamtuf@infosec.exchange @Seirdy@pleroma.envs.net @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space i find it annoying because on GNU coreutil systems i am so used to being able to just append whatever flag i forgot to put in the front and then it's like nah

[wolf480pl@mstdn.io]

@sten @darkuncle @ChuckMcManis @lcamtuf
you expect rare race conditions to occur anywhere but production?

[nazokiyoubinbou@urusai.social]

@lcamtuf Something something reinventing the wheel something.

Jokes aside, I guess that's a very real metaphor... Wheels started off with wood, which of course can break, rip apart at high speeds, etc. We have better treatments and such for wood today than in the olden days, but it still means most of the fundamental issues remain... If you reinvented from scratch, you have to relearn some of that stuff.

[seirdy@pleroma.envs.net]

@Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space @lcamtuf@infosec.exchange @puppygirlhornypost2@transfem.social I’m just saying that slim POSIX implementations that prioritize small size aren’t the best references for a clean-room GNU coreutil rewrite. FreeBSD utils and GNU documentation would be better.

Given the different language, I’m not sure that lightly referencing the GNU source code would even pose a legal risk.

[w8emv@a2mi.social]

@hyc @lcamtuf

One thing that the Rust rewrite of coreutils tried to do was to prove that it was making steady progress by the number of test cases originating from GNU coreutils that it could pass.

I very much suspect that there's a whole host of race condition tests that made it into the test corpus late in the game.

Test-driven rewrite has its limits.

Note the uptick in failures at the very right edge of the graph, they are currently under 90% tests successful.

#coreutils #uutils

[lispi314@udongein.xyz]

@lcamtuf Or why crappy abstractions for POSIX APIs are worse.

[puppygirlhornypost2@transfem.social]

@Seirdy@pleroma.envs.net @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space Also, BSD-Clause and MIT are compatible licenses. IANAL though, so I'm hesitant to discuss how this would actually impact "porting" BSD-Clause code from C to an MIT Licensed Rust codebase

[lispi314@udongein.xyz]

@xerz @star @hypha @lcamtuf Switching to dependencies with a single non-replaceable toolchain is also irresponsible.

Core utilities should not rely on something that can believably be slopped into oblivion with no viable replacement (C compilers are a dime a dozen and comparatively much easier to implement, with many functional replacements readily available).

Proper specification of all the core toolchains should be a bare minimum.

[raven667@hachyderm.io]

@puppygirlhornypost2 @ireneista People talking about UX are often talking about GUIs but aside from GNU making clean copyleft license versions of the (at the time) proprietary Unix utils, GNU also spent a lot of effort in UX like long options and fewer arbitrary restrictions (which made sense on a PDP but not on the larger systems of the 90's and later) which is how they got to be so popular, before Linux was even created. It's too bad that some of the other systems keep looking back farther for inspiration rather than looking around and forward for what the UX of a Unix should be.

[ireneista@adhd.irenes.space]

@raven667 @puppygirlhornypost2 they did, yeah, you're right. they deserve credit for that work.

they did so in a time when UX wasn't yet a science (or rather, design was a science but had not been made rigorous in the domain of computing), so perhaps it's understandable that they still have a ton of UX problems... but you're right. still way better than earlier attempts.

[lispi314@udongein.xyz]

@raymaccarthy @lcamtuf Rust seems to in-practice accomplish very little Ada doesn't do better.